> CVE-2024-28175 [CRITICAL]

« BACK_TO_HOME
PUBLISHED
2024-03-13 21:16
MODIFIED
2025-01-09 17:05
CVSS_SCORE V3
9.0
EPSS (Prob. Exploit)
0.65%
Top 48.4%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.

> AFFECTED_PRODUCTS

Argoproj - Argo Cd
>= 1.0.0 < 2.8.12
Argoproj - Argo Cd
>= 2.9.0 < 2.9.8
Argoproj - Argo Cd
>= 2.10.0 < 2.10.3

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
Low (L)
Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur)
User Interaction
Required (R)
Nécessite une action utilisateur (clic lien, ouverture fichier, etc.)
S (Périmètre)
Scope
Changed (C)
Impact s'étend au-delà du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
High (H)
Divulgation totale d'informations
I (Impact Intégrité)
Integrity Impact
High (H)
Modification totale des données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
High
Divulgation totale d'informations
Intégrité
High
Modification totale des données possible
Disponibilité
High
Interruption totale du service possible

> GITHUB SECURITY ADVISORY

GHSA-jwv5-8mqv-g387 CRITICAL

Cross-site scripting on application summary component

AFFECTED PACKAGES:
GO / github.com/argoproj/argo-cd
>= 1.0.0, <= 1.8.7
GO / github.com/argoproj/argo-cd/v2
>= 2.0.0, < 2.8.12
Fixed in: 2.8.12
GO / github.com/argoproj/argo-cd/v2
>= 2.10.0, < 2.10.3
Fixed in: 2.10.3
GO / github.com/argoproj/argo-cd/v2
>= 2.9.0, < 2.9.8
Fixed in: 2.9.8

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Cross-site scripting on application summary component in argo-cd

AFFECTED PACKAGES:
Unknown / Unknown
11 versions affected
ALIASES:
BIT-argo-cd-2024-28175, GHSA-jwv5-8mqv-g387, GO-2024-2646

> HISTORIQUE DES MODIFICATIONS

Première apparition
13/03/2024 21:16
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 14:48
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME